This is cool and a lot cheaper than the HSM option. It's not entirely clear to me what the API for using the keys will be. The white paper gives an example of g

This is cool and a lot cheaper than the HSM option. It's not entirely clear to me what the API for using the keys will be. The white paper gives an example of getting a plaintext key and encryption key for doing application level encryption. Is there also a signature API? It would be cool if you could build a certificate authority where the root keys are stored in this service. That would require some ability to generate signatures via the API.